{"id":"CVE-2025-10158","aliases":["ALPINE-CVE-2025-10158","ALSA-2026:6390","ALSA-2026:6436","ALSA-2026:6825","AZL-70387","AZL-70667","BELL-CVE-2025-10158","CLSA-2026-1775723827","CLSA-2026-1777469554","CLSA-2026-1777474126","CLSA-2026-1777544655","CLSA-2026-1778236507","DEBIAN-CVE-2025-10158","EUVD-2025-198005","GHSA-3rvc-qcwh-fhqv","JLSEC-2026-625","MGASA-2026-0048","OESA-2026-1172","OESA-2026-1173","OESA-2026-1174","OESA-2026-1175","OESA-2026-1176","OESA-2026-1177","RHSA-2026:20602","RHSA-2026:20603","RHSA-2026:20604","RHSA-2026:20696","RHSA-2026:6390","RHSA-2026:6436","RHSA-2026:6825","RLSA-2026:6390","RLSA-2026:6436","RLSA-2026:6825","SUSE-SU-2025:4511-1","SUSE-SU-2026:0005-1","SUSE-SU-2026:0041-1","SUSE-SU-2026:0069-1","SUSE-SU-2026:20044-1","SUSE-SU-2026:20058-1","SUSE-SU-2026:2038-1","SUSE-SU-2026:2048-1","SUSE-SU-2026:2083-1","SUSE-SU-2026:21726-1","SUSE-SU-2026:21739-1","SUSE-SU-2026:21747-1","SUSE-SU-2026:21795-1","SUSE-SU-2026:21980-1","SUSE-SU-2026:22015-1","UBUNTU-CVE-2025-10158","USN-8283-1","USN-8349-1","openSUSE-SU-2025:15827-1","openSUSE-SU-2026:20754-1","openSUSE-SU-2026:20877-1"],"status":"published","title":"Rsync: Out of bounds array access via negative index","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00349,"percentile":0.28777,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-129"],"published":"2025-11-18T14:24:19Z","modified":"2026-10-29T11:32:36Z","fixes":[{"ecosystem":"Alpine:v3.19","package":"rsync","fixed_in":["3.4.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"rsync","fixed_in":["3.4.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"rsync","fixed_in":["3.4.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"rsync","fixed_in":["3.4.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"rsync","fixed_in":["3.4.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"rsync","fixed_in":["3.4.1-r1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"rsync","fixed_in":["3.2.5-3.el9_7.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"rsync-daemon","fixed_in":["3.2.5-3.el9_7.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"rsync-rrsync","fixed_in":["3.2.5-3.el9_7.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rsync","fixed_in":["3.1.3-24.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"rsync-daemon","fixed_in":["3.1.3-24.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"rsync-daemon","fixed_in":["3.4.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"rsync-rrsync","fixed_in":["3.4.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rsync","fixed_in":["3.4.1-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"rsync","fixed_in":["3.4.1-2"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"rsync","fixed_in":["3.2.7-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"rsync","fixed_in":["3.4.1-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"rsync","fixed_in":["3.4.1-r1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","fixed_in":["3.2.5-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","fixed_in":["3.2.5-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","fixed_in":["3.2.5-3.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rsync","fixed_in":["3.2.7-1+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rsync","fixed_in":["3.4.1+ds1-5+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rsync","fixed_in":["3.4.1+ds1-7"],"sources":["osv"]},{"ecosystem":"Julia","package":"rsync_jll","fixed_in":["3.4.4+0"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"rsync","fixed_in":["3.2.7-1.3.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"rsync","fixed_in":["3.2.7-7.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"rsync","fixed_in":["3.1.3-12.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"rsync","fixed_in":["3.2.5-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"rsync","fixed_in":["3.2.5-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"rsync","fixed_in":["3.2.7-7.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"rsync","fixed_in":["3.2.7-7.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-daemon","fixed_in":["0:3.2.5-3.el9_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-rrsync","fixed_in":["0:3.2.5-3.el9_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync","fixed_in":["0:3.2.5-3.el9_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debuginfo","fixed_in":["0:3.2.5-3.el9_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debugsource","fixed_in":["0:3.2.5-3.el9_7.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync","fixed_in":["0:3.1.3-24.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-daemon","fixed_in":["0:3.1.3-24.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debuginfo","fixed_in":["0:3.1.3-24.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debugsource","fixed_in":["0:3.1.3-24.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync-daemon","fixed_in":["0:3.4.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync-rrsync","fixed_in":["0:3.4.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync","fixed_in":["0:3.4.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync-debuginfo","fixed_in":["0:3.4.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync-debugsource","fixed_in":["0:3.4.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"rsync","fixed_in":["0:3.2.5-3.el9_7.2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"rsync","fixed_in":["0:3.1.3-24.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"rsync","fixed_in":["0:3.4.1-2.el10_1.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"rsync","fixed_in":["3.2.7-150600.3.14.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"rsync","fixed_in":["3.2.7-150600.3.14.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"rsync","fixed_in":["3.1.3-3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rsync","fixed_in":["3.2.3-150400.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rsync","fixed_in":["3.2.3-150400.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rsync","fixed_in":["3.2.3-150400.3.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"rsync","fixed_in":["3.2.3-150000.4.39.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"rsync","fixed_in":["3.2.7-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"rsync","fixed_in":["3.3.0-slfo.1.1_4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","fixed_in":["3.1.0-2ubuntu0.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","fixed_in":["3.1.1-3ubuntu1.3+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","fixed_in":["3.1.2-2.1ubuntu1.6+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","fixed_in":["3.1.3-8ubuntu0.9+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"rsync","fixed_in":["3.2.7-0ubuntu0.22.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"rsync","fixed_in":["3.2.7-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"rsync","fixed_in":["3.4.1+ds1-5ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"rsync","fixed_in":["3.4.1+ds1-7","3.4.1+ds1-7ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rsync","fixed_in":["3.4.1-4.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.19","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-r1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_7.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_7.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9_7.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-24.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-24.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.7-r0"},{"fixed":"3.2.7-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.4.1-r0"},{"fixed":"3.4.1-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.5-r0"},{"fixed":"3.4.1-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-3.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-12.0.1.el7_9.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-19.el9.tuxcare.els4"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1+deb12u4"}]}],"versions":["3.2.7-1","3.2.7-1+deb12u1","3.2.7-1+deb12u2","3.2.7-1+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5+deb13u1"}]}],"versions":["3.4.1+ds1-5"]},{"source":"osv","ecosystem":"Debian:14","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-7"}]}],"versions":["3.4.1+ds1-5","3.4.1+ds1-6"]},{"source":"osv","ecosystem":"Julia","package":"rsync_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.4+0"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1.3.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-7.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-12.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.5-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-7.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-7.oe2403sp1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-19.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-19.el9_2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-19.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.4::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.3-19.el9_4.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux_eus:10.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_0.2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_7.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-24.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-24.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-24.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-24.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync-rrsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.1","package":"rsync-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.5-3.el9_7.2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-24.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.1-2.el10_1.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-150600.3.14.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-150600.3.14.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150400.3.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.3-150000.4.39.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.0-slfo.1.1_4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-160000.4.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-2ubuntu0.4+esm3"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4","3.1.0-2ubuntu0.4+esm1","3.1.0-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+esm5"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2","3.1.1-3ubuntu1.3+esm3","3.1.1-3ubuntu1.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+esm3"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6","3.1.2-2.1ubuntu1.6+esm1","3.1.2-2.1ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+esm1"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7","3.1.3-8ubuntu0.8","3.1.3-8ubuntu0.9"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.6"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1","3.2.7-0ubuntu0.22.04.2","3.2.7-0ubuntu0.22.04.3","3.2.7-0ubuntu0.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu1.4"}]}],"versions":["3.2.7-1","3.2.7-1build1","3.2.7-1build2","3.2.7-1ubuntu1","3.2.7-1ubuntu1.1","3.2.7-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5ubuntu1.2"}]}],"versions":["3.4.1+ds1-3","3.4.1+ds1-4","3.4.1+ds1-5","3.4.1+ds1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-7"}]}],"versions":["3.4.1+ds1-5ubuntu1","3.4.1+ds1-6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-0ubuntu0.22.04.6"}]}],"versions":["3.2.3-4ubuntu1","3.2.3-4ubuntu2","3.2.3-8ubuntu1","3.2.3-8ubuntu2","3.2.3-8ubuntu3","3.2.3-8ubuntu3.1","3.2.7-0ubuntu0.22.04.2","3.2.7-0ubuntu0.22.04.3","3.2.7-0ubuntu0.22.04.4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.7-1ubuntu1.4"}]}],"versions":["3.2.7-1","3.2.7-1build1","3.2.7-1build2","3.2.7-1ubuntu1","3.2.7-1ubuntu1.1","3.2.7-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-5ubuntu1.2"}]}],"versions":["3.4.1+ds1-3","3.4.1+ds1-4","3.4.1+ds1-5","3.4.1+ds1-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1+ds1-7ubuntu0.2"}]}],"versions":["3.4.1+ds1-5ubuntu1","3.4.1+ds1-6","3.4.1+ds1-7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-2ubuntu0.4+esm3"}]}],"versions":["3.0.9-4ubuntu1","3.1.0-2","3.1.0-2ubuntu0.1","3.1.0-2ubuntu0.2","3.1.0-2ubuntu0.3","3.1.0-2ubuntu0.4","3.1.0-2ubuntu0.4+esm1","3.1.0-2ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-3ubuntu1.3+esm5"}]}],"versions":["3.1.1-3","3.1.1-3ubuntu1","3.1.1-3ubuntu1.1","3.1.1-3ubuntu1.2","3.1.1-3ubuntu1.3","3.1.1-3ubuntu1.3+esm1","3.1.1-3ubuntu1.3+esm2","3.1.1-3ubuntu1.3+esm3","3.1.1-3ubuntu1.3+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2.1ubuntu1.6+esm3"}]}],"versions":["3.1.2-2","3.1.2-2.1","3.1.2-2.1ubuntu1","3.1.2-2.1ubuntu1.1","3.1.2-2.1ubuntu1.2","3.1.2-2.1ubuntu1.3","3.1.2-2.1ubuntu1.4","3.1.2-2.1ubuntu1.5","3.1.2-2.1ubuntu1.6","3.1.2-2.1ubuntu1.6+esm1","3.1.2-2.1ubuntu1.6+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.3-8ubuntu0.9+esm1"}]}],"versions":["3.1.3-6","3.1.3-8","3.1.3-8ubuntu0.1","3.1.3-8ubuntu0.2","3.1.3-8ubuntu0.3","3.1.3-8ubuntu0.4","3.1.3-8ubuntu0.5","3.1.3-8ubuntu0.7","3.1.3-8ubuntu0.8","3.1.3-8ubuntu0.9"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rsync","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.1-4.1"}]}]}],"products":[{"vendor":"rsync","product":"rsync"},{"vendor":"samba","product":"rsync"}],"references":[{"url":"https://github.com/RsyncProject/rsync/commit/797e17fc4a6f15e3b1756538a9f812b63942686f","tags":["patch","fix","web","article"]},{"url":"https://attackerkb.com/assessments/fbacb2a6-d1cd-4011-bb3a-f06b1c8306b1","tags":["technical-description","article","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10158","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-3rvc-qcwh-fhqv","tags":["web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-10158","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6390","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-10158","tags":["report"]},{"url":"https://bugzilla.redhat.com/2415637","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-6390.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6436","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-6436.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:6825","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-6825.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-10158","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1775723827.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1777469554.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12085","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12086","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1777474126.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1777544655.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778236507.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10158.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-10158","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0048.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35177","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QZOPBIA4TYYH7HBPKXO4XFIWVXML27HR/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1172","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1173","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1174","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1175","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1176","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1177","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20602","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2415637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2458898","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20602.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-10158","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-41035","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-41035","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-41035","tags":["advisory"]},{"url":"https://github.com/RsyncProject/rsync/issues/871","tags":["article"]},{"url":"https://github.com/RsyncProject/rsync/releases","tags":["article"]},{"url":"https://www.openwall.com/lists/oss-security/2026/04/16/2","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20603","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2330577","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20603.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12086","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-12086","tags":["advisory"]},{"url":"https://kb.cert.org/vuls/id/952657","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20604","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20604.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20696","tags":["advisory"]},{"url":"https://issues.redhat.com/browse/RHEL-174895","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_20696.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6390.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6436.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6825.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:6390","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:6436","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:6825","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254511-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1254441","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-10158","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260005-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260041-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260069-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620044-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620058-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262038-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1234100","tags":["report"]},{"url":"https://bugzilla.suse.com/1234101","tags":["report"]},{"url":"https://bugzilla.suse.com/1234102","tags":["report"]},{"url":"https://bugzilla.suse.com/1234103","tags":["report"]},{"url":"https://bugzilla.suse.com/1234104","tags":["report"]},{"url":"https://bugzilla.suse.com/1235475","tags":["report"]},{"url":"https://bugzilla.suse.com/1262223","tags":["report"]},{"url":"https://bugzilla.suse.com/1264511","tags":["report"]},{"url":"https://bugzilla.suse.com/1264512","tags":["report"]},{"url":"https://bugzilla.suse.com/1264513","tags":["report"]},{"url":"https://bugzilla.suse.com/1264514","tags":["report"]},{"url":"https://bugzilla.suse.com/1264515","tags":["report"]},{"url":"https://bugzilla.suse.com/1265296","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12084","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-29518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-43620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45232","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262048-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262083-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621726-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201840","tags":["report"]},{"url":"https://bugzilla.suse.com/1202970","tags":["report"]},{"url":"https://bugzilla.suse.com/1204538","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-29154","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621739-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621747-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621795-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621980-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622015-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-10158","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8283-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8349-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-29518","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-41035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43619","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-43620","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-45232","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-10158","title":"Rsync: Out of bounds array access via negative index","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T14:24:19.21Z","modified":"2025-11-19T16:48:56.591Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:32:30.643267Z"}],"euvd":[{"id":"EUVD-2025-198005","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T14:24:19Z","modified":"2025-11-19T16:48:56Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:15.429944Z"}],"ghsa":[{"id":"GHSA-3rvc-qcwh-fhqv","title":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds...","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T15:30:53Z","modified":"2025-11-18T15:30:54Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:04:51.288675Z"}],"nvd":[{"id":"CVE-2025-10158","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T15:16:25.433Z","modified":"2026-10-19T13:10:00.11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T14:11:44.669367Z"}],"osv":[{"id":"ALPINE-CVE-2025-10158","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T15:16:25.433Z","modified":"2026-08-27T22:18:02.760128514Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:49.709457Z"},{"id":"BELL-CVE-2025-10158","status":"published","published":"2025-11-19T06:06:32.267167Z","modified":"2026-01-26T09:41:21.355633Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-10158","title":"Rsync: Out of bounds array access via negative index","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T14:24:19.21Z","modified":"2026-10-28T10:58:56.866414571Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-129"],"updated_at":"2026-11-02T15:44:45.712478Z"},{"id":"DEBIAN-CVE-2025-10158","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The   malicious   rsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T15:16:25.433Z","modified":"2026-10-23T17:47:51.508647624Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"JLSEC-2026-625","title":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds...","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The\n\nmalicious\n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2026-06-25T17:41:14.392Z","modified":"2026-07-18T00:02:16.486893303Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:47:18.573531Z"},{"id":"OESA-2026-1172","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nA malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:27.928994155Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1173","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nA malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:28.689368889Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1174","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nA malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:27.925067495Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1175","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nA malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:28.844532151Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1176","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nA malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:29.173130227Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2026-1177","title":"rsync security update","description":"Rsync is an open source utility that provides fast incremental file transfer. It uses the \u0026amp;quot;rsync algorithm\u0026amp;quot; which provides a very fast method for bringing remote files into sync. It does this by sending just the differences in the files across the link, without requiring that both sets of files are present at one of the ends of the link beforehand.\r\n\r\nSecurity Fix(es):\n\nA malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.(CVE-2025-10158)","status":"published","published":"2026-01-16T11:10:12Z","modified":"2026-08-18T01:19:29.204196849Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"RHSA-2026:20602","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-26T10:07:46Z","modified":"2026-10-10T10:05:56Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20603","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-26T10:07:46Z","modified":"2026-10-10T10:05:56Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20604","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-26T10:07:47Z","modified":"2026-10-10T10:05:57Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:20696","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-05-27T10:07:23Z","modified":"2026-10-10T10:06:02Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:18.983284Z"},{"id":"RHSA-2026:6390","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-04-02T10:19:01Z","modified":"2026-07-12T10:12:58Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:6436","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-04-03T10:09:34Z","modified":"2026-07-12T10:12:58Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:21.91255Z"},{"id":"RHSA-2026:6825","title":"Red Hat Security Advisory: rsync security update","status":"published","published":"2026-04-08T10:08:56Z","modified":"2026-07-12T10:13:02Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:6390","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-07T12:03:55.701474Z","modified":"2026-04-07T12:30:14.706026Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:6436","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-09T06:02:09.317838Z","modified":"2026-04-09T06:30:18.448514Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:6825","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.\n\nSecurity Fix(es):\n\n* rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-04-09T12:07:05.48411Z","modified":"2026-04-09T12:30:14.737822Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2025-10158","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The malicious rsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T15:16:00Z","modified":"2026-06-16T13:44:19.281645056Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ALSA-2026:6390","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-01T00:00:00Z","modified":"2026-10-29T11:32:36.991486863Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:6436","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-02T00:00:00Z","modified":"2026-10-29T11:02:29.054482224Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:6825","title":"Moderate: rsync security update","description":"The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool.  \n\nSecurity Fix(es):  \n\n  * rsync: Rsync: Out of bounds array access via negative index (CVE-2025-10158)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-04-07T00:00:00Z","modified":"2026-10-29T11:30:41.681327397Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"AZL-70387","title":"CVE-2025-10158 affecting package rsync for versions less than 3.4.1-2","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T15:16:25Z","modified":"2026-06-02T05:26:23Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"AZL-70667","title":"CVE-2025-10158 affecting package rsync for versions less than 3.4.1-2","description":"A malicious client acting as the receiver of an rsync file transfer can trigger an out of bounds read of a heap based buffer, via a negative array index. The \n\nmalicious \n\nrsync client requires at least read access to the remote rsync module in order to trigger the issue.","status":"published","published":"2025-11-18T15:16:25Z","modified":"2026-04-21T04:36:26.587424Z","updated_at":"2026-11-02T15:28:08.907584Z"},{"id":"CLSA-2026-1775723827","title":"rsync: Fix of CVE-2025-10158","description":"- CVE-2025-10158: fix invalid access to files array via negative parent_ndx","status":"published","published":"2026-04-09T08:37:11Z","modified":"2026-06-01T00:32:46.78395345Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777469554","title":"rsync: Fix of 2 CVEs","description":"- CVE-2024-12086: prevent server from reading arbitrary client files via\n  path traversal\n- CVE-2025-10158: fix invalid access to files array in sender\n- Add upstream stability fix (RsyncProject/rsync PR #706):\n  use-after-free in generator\n- Enable Amazon Linux 2 ELS","status":"published","published":"2026-07-06T16:28:40Z","modified":"2026-10-26T09:31:57.658523187Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777474126","title":"rsync: Fix of 2 CVEs","description":"- CVE-2024-12086: prevent server from reading arbitrary client files via\n  path traversal\n- CVE-2025-10158: fix invalid access to files array in sender\n- Add upstream stability fix (RsyncProject/rsync PR #706):\n  use-after-free in generator\n- Enable Amazon Linux 2 ELS","status":"published","published":"2026-04-29T14:48:51Z","modified":"2026-06-01T00:33:27.21337757Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777544655","title":"rsync: Fix of 2 CVEs","description":"- CVE-2024-12086: prevent server from reading arbitrary client files via\n  path traversal\n- CVE-2025-10158: fix invalid access to files array in sender\n- Add upstream stability fix (RsyncProject/rsync PR #706):\n  use-after-free in generator\n- Enable Amazon Linux 2 ELS","status":"published","published":"2026-05-02T01:10:44Z","modified":"2026-06-01T00:33:18.62996616Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778236507","title":"rsync: Fix of 3 CVEs","description":"- CVE-2025-10158: fix invalid access to files array in sender\n- CVE-2024-12747: fix symlink race condition in sender\n- CVE-2024-12086: fix server leak of arbitrary client files via crafted checksums and fuzzy basis","status":"published","published":"2026-05-08T10:35:12Z","modified":"2026-10-21T10:45:54.817187608Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"MGASA-2026-0048","title":"Updated rsync packages fix security vulnerability","description":"Out of bounds array access via negative index. (CVE-2025-10158)\n","status":"published","published":"2026-03-06T03:01:36Z","modified":"2026-04-16T04:42:40.974721424Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15827-1","title":"rsync-3.4.1-4.1 on GA media","description":"These are all security issues fixed in the rsync-3.4.1-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-18T00:00:00Z","modified":"2026-03-23T04:54:13.364725Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20754-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n","status":"published","published":"2026-05-14T16:43:27Z","modified":"2026-05-19T18:23:46.729114849Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20877-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:13:41Z","modified":"2026-06-04T09:00:10.423530016Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2025:4511-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2025-10158: Fixed out-of-bounds array access via negative index (bsc#1254441)\n","status":"published","published":"2025-12-23T12:14:35Z","modified":"2026-03-23T04:51:49.787344Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0005-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)\n","status":"published","published":"2026-01-02T12:30:51Z","modified":"2026-03-23T04:51:50.857602Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0041-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)\n","status":"published","published":"2026-01-06T10:33:33Z","modified":"2026-03-23T04:51:41.707364Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0069-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)\n","status":"published","published":"2026-01-08T13:21:48Z","modified":"2026-02-04T04:01:04.065846Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20044-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)\n","status":"published","published":"2026-01-08T15:49:46Z","modified":"2026-03-23T04:52:31.381548Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:20058-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues:\n\n- CVE-2025-10158: Fixed out of bounds array access via negative index (bsc#1254441)\n","status":"published","published":"2026-01-02T11:13:05Z","modified":"2026-03-23T04:52:32.762457Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:2038-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n    \n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: Count of entries mismatch can lead to a use-after-free (bsc#1262223)\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T13:33:41Z","modified":"2026-05-22T09:00:05.164069318Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2048-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-25T13:55:42Z","modified":"2026-05-26T08:15:05.350251039Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:2083-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-27T07:56:11Z","modified":"2026-05-28T08:15:05.799079873Z","updated_at":"2026-11-02T15:54:01.953589Z"},{"id":"SUSE-SU-2026:21726-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\nSecurity issues:\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n\nNon security issues:\n\n- rsync --delay-updates never updates after interruption (bsc#1204538).\n- Fix duplication of flag causing illegal hashkey failures.\n","status":"published","published":"2026-05-21T11:04:19Z","modified":"2026-05-23T18:23:40.42363199Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21739-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (bsc#1264511).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-05-21T11:23:33Z","modified":"2026-05-23T18:23:41.730720723Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21747-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n","status":"published","published":"2026-05-14T16:43:03Z","modified":"2026-05-27T18:24:07.049257371Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21795-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n","status":"published","published":"2026-05-14T16:43:03Z","modified":"2026-05-28T18:24:09.654244481Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:21980-1","title":"Security update for rsync","description":"This update for rsync fixes the following issues\n\n- CVE-2025-10158: Out of bounds array access via negative index (bsc#1254441).\n- CVE-2026-29518: Symlink-Race TOCTOU in Daemon (use chroot = no) (bsc#1264511).\n- CVE-2026-41035: count of entries mismatch can lead to a use-after-free (bsc#1262223).\n- CVE-2026-43617: Authorization Bypass via Hostname Resolution (bsc#1264515).\n- CVE-2026-43618: Integer Overflow Information Disclosure (bsc#1264512).\n- CVE-2026-43619: Symlink Race Condition via Path-Based Syscalls (bsc#1264514).\n- CVE-2026-43620: Out-of-Bounds Array Read via recv_files() (bsc#1264513).\n- CVE-2026-45232: Off-by-one stack OOB write in HTTP CONNECT proxy response parsing (bsc#1265296).\n","status":"published","published":"2026-06-02T09:14:50Z","modified":"2026-06-04T09:00:07.395663315Z","updated_at":"2026-11-02T15:54:02.654057Z"}]},"sources_more":{"osv":3}}